Asentria SiteBoss 530, User Manual

Page: 68 / 140

Asentria SiteBoss 530 User Manual
62
VPN Client
SSL VPN Client support is where the unit runs OpenVPN version 2.1_rc15 to connect to a an OpenVPN server to
form a VPN where SSL/TLS is used for authentication and key exchange.
The benefits of using SSL VPN Client are:
•
SSL VPNs are simple, unlike other VPN technologies such as IPsec.
•
SSL VPNs can work through NAT-ing routers/firwalls, unlike other VPN technologies such as IPsec.
•
The OpenVPN distribution is freely available and works on a variety of platforms including Unix/Linux,
Windows, and Mac.
When configuring SSL VPN Client it is best to use a question and answer format because it is relatively complex.
How do I specify SSL VPN Client mode?
Set
net.vpn.mode
to
SSL CLIENT
.
How many VPNs can I configure?
The unit can be configured with up to 2 VPNs. The configuration settings for these VPNs are under the
net.vpn.*
key branch.
How many VPNs can I run at one time?
Although the unit supports multiple VPN configurations, only 1 VPN can be operational at any one time. The
setting that controls which VPN can be operational is the
net.vpn.active
key. It has values of VPN1, VPN2, or
NONE.
Is my VPN connecting to SitePath?
The unit uses this feature to connect to SitePath. If you are using it with SitePath, typically most of the more
arcane configuration items are automatically configured by SitePath. However, if you are configuring your own
VPN server then you need to tell the unit that by setting
sys.sitepath.vpn =NONE
.
Where is my VPN connecting to?
As a client, the unit must know where the server is. You tell it the server's address with the
net.vpn[x].remote.host
key. Set it to an IP address or DNS name of the server, or the IP address or DNS
name of the NAT-ing firwall viewable from the unit that will route the VPN connections to the server. Note that if
you use a DNS name, you must have DNS configured on the unit. Sometimes, DNS can be configured
automatically when you choose DHCP Ethernet addressing and
the net.dns.mode
to be
ETH1-DCHP
or
ETH2-DHCP
.
What network medium (network interface) should my VPN use?
Depending on the application, the unit can have multiple network interfaces at its disposal: Ethernet, wireless
modem, ADSL, and POTS PPP. The
net.vpn[x].if.public
key controls which interface the VPN uses. By
default the unit uses the network interface that owns the IP route to the VPN server. (This is when
net.vpn[x].if.public
is set to
ANY
.) But you may want to have the unit use an explicit interface for VPN. The
primary purpose for this that if the VPN is not always used, and the interface you want the VPN to use is not
always used, then the unit knows that to bring up the VPN, it must first bring up the interface. The secondary
purpose is to provide protection for situations where the VPN is using one interface, but then another interface
that's not always used comes up, possibly overriding the default route, and you don't want the VPN to follow the
default route and hop on to the other interface unintentionally (thus breaking VPN connectivity).
Should my VPN start automatically when the unit starts?
If yes, then set
net.vpn[x].startmode
to
AUTO-ACTIVE
. If no then set it to MANUAL. When in MANUAL
startmode, start the VPN by setting
net.vpn[x].cmd =2
. Once started, the VPN will maintain connectivity until
told to stop (either by setting
net.vpn[x].cmd =0
, or by the unit resetting when the VPN is in MANUAL
startmode). If there is no connectivity to the server, as long as the VPN is configured correctly, the unit will keep
trying to connect to the server until it connects or it is told to stop.